67 plugins. 329 skills. 73 agents.
Quality engineering skills and agents for Claude Code, one QA area per plugin. Every component is reviewed before merge, so what ships is what passed review.
/plugin marketplace add testland/qaskills.sh (opens in new window) installs skills only. Agents and role bundles need Claude Code.
hover a square to see the skill
Each bundle pulls in every member plugin. Start with qa-starter, or pick the role closest to your job.
The cross-cutting plugins every tester needs regardless of stack - test process, test data, environments, test-code review, reporting, flake triage, bug repro, defect management, CI integration, and manual/exploratory testing. Start here.
Search by plugin, skill or agent name. Filter by category, or show only the plugins that ship agents.
Showing all 67 plugins
Test process and strategy: risk-based testing, test strategies, Definition of Done, smoke gates, test pyramid balance, effort estimates and post-mortems. Also covers E2E suite budgets, test ideas from stories and live features, framework choice, and attack-surface checklists. Agents (release-readiness-checker, quality-coach, release-engineer) run multi-gate go / no-go checks, audit work against the Definition of Done, and walk a release runbook with human gates.
QA team management for QA managers and heads of quality: skill matrices with gap analysis, quality status digests, structured hiring, and exec narratives. Covers capability mapping per ISTQB CTAL-TM v3.0, the hiring chain from job description to 30-60-90 onboarding, and Minto-pyramid quality narratives. An agent (qa-manager) produces the weekly red / amber / green status digest from CI, tracker, and quarantine data.
Test data engineering: Faker and factories, WireMock and MSW API mocks, seed datasets, golden files, and boundary, pairwise and negative test inputs. Includes FactoryBot, Mimesis and Bogus, a Mountebank reference, synthetic PII, and a malicious payload bank. Agents (golden-file-manager, test-data-setup-agent) maintain snapshot baselines and set up a feature's full test-data layer.
Test environment setup: Testcontainers and Docker Compose services, Playwright fixtures, database snapshot and restore, and flag-aware test harnesses. Agents (test-environment-bootstrapper, db-snapshot-restore) wire a full integration environment for a greenfield service and reset the database between tests. Shared-state diagnosis composes with e2e-flake-bisector in qa-flake-triage.
Test impact analysis: run only the tests a change affects, and keep the regression suite lean with evidence-based test removal. The selector cuts per-PR run time; a curation agent (regression-suite-curator) reviews per-test signal and noise at quarterly and sprint grains, gated by the removal criteria.
Test case management for TestRail, Xray, Zephyr Scale, Allure TestOps and Qase: case authoring, ISO 29119-3 case anatomy, and traceability matrices. Agents (test-case-quality-critic, tcm-migration-agent) audit test cases against the review rubric and migrate cases between tools. Covers pre-execution case management; result sync lives in qa-test-reporting.
Test reporting and coverage analytics: JUnit XML, LCOV and Cobertura parsing, Allure reports, coverage diffs, and test run summaries for pull requests. Also covers JaCoCo and coverage.py analysis, risk-ranked coverage targets, TestRail / Xray / Zephyr Scale result sync, and Currents analytics. Agents (daily-test-suite-aggregator, release-quality-report-agent) roll up daily results across suites and assemble a release-quality go / no-go report. Jest and Vitest coverage lives in qa-unit-tests-js.
Test code review for test files only: conventions, isolation, object-model patterns, framework architecture audits, and test suite health checks. Includes a framework blueprint for new suites and a test design scorecard. Agents (test-code-critic, e2e-selector-quality-critic, framework-architecture-auditor, test-suite-health-auditor) review structure, assertions and mocking, selector fragility, framework architecture, and suite health. Production code is out of scope.
API testing with Postman and Newman, REST Assured and Karate, plus Schemathesis and RESTler fuzzing and API tests run under injected network chaos. An authoring agent (api-test-author) picks the tool from observable project facts and writes one functional test per endpoint and scenario.
Behavior-driven development with Cucumber, Behave and Reqnroll: Gherkin from user stories and acceptance criteria, step libraries, and living docs. Converts stories, acceptance-criteria lists, manual steps or raw specs into Gherkin, keeps step definitions DRY, and covers SpecFlow-to-Reqnroll migration. Agents (bdd-scenario-author, gherkin-style-reviewer) write scenarios with step stubs and flag imperative steps and technical leakage.
Contract testing for microservices: Pact consumer and provider tests, OpenAPI, GraphQL and Protobuf breaking-change checks, and a combined deploy gate. The gate aggregates Pact can-i-deploy, oasdiff, graphql-inspector and buf breaking into one go / no-go verdict. Agents (contract-drift-investigator, contract-test-scaffolder) trace contract drift to its source and scaffold contract tests from a spec.
Desktop application testing for Windows (FlaUI, WinAppDriver), Electron (Playwright) and Qt (Qt Test), with a driver decision table. Also covers Linux AT-SPI, Spectron migration, and a test-review hazard checklist. An authoring agent (desktop-test-author) detects the driver, scaffolds a test project when none exists, and writes per-flow tests. macOS XCTest UI tests live in qa-mobile.
Embedded C/C++ testing: GoogleTest on ARM, Unity and Ceedling with CMock mocks, QEMU system emulation, gcov coverage, and hardware-in-the-loop. An authoring agent (embedded-test-author) detects the framework and execution path, scaffolds the harness when none exists, and writes one unit test per spec.
Game testing for Unity, Unreal and Godot: engine test frameworks, frame-time and memory profiling, gameplay record and replay, and multiplayer coverage. Includes the six-category game-test taxonomy and a platform certification overview (Sony TRC, Nintendo Lotcheck, Xbox Requirements, Steam Direct). An authoring agent (game-test-scenario-author) detects the engine, scaffolds the test tree, and writes one scenario per spec.
Mobile app testing: XCUITest and Espresso for native apps, Appium, Detox and Maestro across platforms, Flutter tests, and mobile accessibility checks. XCUITest also covers macOS desktop apps, and a tiered device matrix keeps CI cost down. An authoring agent (mobile-test-author) detects the driver, scaffolds a harness when none exists, and writes one test per spec. Mobile-web viewport emulation lives in qa-web-e2e.
Mutation testing with StrykerJS, Stryker.NET, PIT, mutmut and Mull: one canonical tool per language, plus triage of surviving mutants. Survivor triage classifies why each mutant lived (missing case, weak assertion, equivalent mutant) and drafts the tests that kill it.
Property-based testing with Hypothesis (Python), fast-check (JS/TS), proptest (Rust) and jqwik (JVM): generators, shrinking, and CI integration. Agents (property-based-test-author, vacuous-property-critic) write one property per invariant and flag assume-heavy or always-true properties.
Test-driven development for people and coding agents: red-green-refactor one test at a time, reproduce bugs with a failing test first, and prove a change works with test evidence before calling it done.
Go and Rust unit testing: table-driven Go tests with t.Run subtests, benchmarks, native fuzzing and the race detector, plus cargo test with Criterion. Each language skill covers framework choice and test conventions, with Ginkgo and Go mocking, rstest and mockall as references.
JavaScript and TypeScript unit testing with Jest and Vitest: configuration, mocking, coverage, CI, and choosing between the two. References cover Mocha maintenance, Jasmine-to-Jest migration, and deep coverage analysis. Test-code hygiene lives in qa-test-review.
JVM unit testing with JUnit 5: parameterized tests, lifecycle hooks, extensions, coverage and CI, plus framework choice for Java, Kotlin, Groovy and Scala. References cover Kotest, Spock, TestNG, ScalaTest and AssertJ.
.NET unit testing with xUnit.net: Fact and Theory tests, fixtures, parallel execution and CI, with NUnit, MSTest and FluentAssertions as references. Recommends xUnit for new projects, follows an existing NUnit or MSTest convention, and notes the FluentAssertions v8 license change.
Python unit testing with pytest: fixtures, parametrize, markers, mocking, coverage and CI, plus async tests with pytest-asyncio. Covers framework choice and test conventions, with unittest and doctest as references.
Web E2E testing with Playwright, Cypress, Selenium and WebdriverIO, plus cloud grids, a self-hosted Selenium Grid 4, and cross-browser test matrices. Covers BrowserStack, Sauce Labs and LambdaTest, traffic-based T1/T2/T3 browser tiers, a framework decision guide, and Playwright's agent tooling (playwright-cli, Playwright MCP, planner/generator/healer Test Agents). Agents (playwright-codegen-reviewer, automation-harness-bootstrapper) refactor recorded Playwright or Cypress Studio specs and scaffold a full E2E harness for a repo with no suite.
Accessibility testing against WCAG 2.2: automated scans with axe-core, pa11y, Lighthouse, WAVE and IBM Equal Access, plus manual screen-reader scripts. Covers keyboard navigation and focus traps, color contrast, ARIA authoring patterns, a CI gate that fails only on new violations, and per-page compliance reports by success criterion. A review agent (accessibility-code-critic) reads component source for WCAG anti-patterns.
Browser extension testing for Chrome and Firefox: Playwright extension fixtures, message-passing tests, and the Manifest V3 test surface. Includes the reload matrix, chrome.storage quota tests and the web-ext Firefox CLI, plus an authoring agent (extension-test-author) that writes one Playwright spec per behavior spec.
Data quality testing for analytical pipelines: dbt tests, Great Expectations, Soda checks, data contracts, and a go / no-go release gate. Extracts data contracts from data-product specs and covers tool choice and severity conventions. Agents (schema-diff-reviewer, data-anomaly-triager) review schema diffs for breaking changes and classify failed checks by anomaly type and likely owner.
Localization and internationalization testing: string coverage, pseudo-localization, right-to-left layouts, and locale date, number and currency formats.
PDF and print testing: per-page PDF snapshot diffs, cross-engine HTML-to-PDF regression, print stylesheet checks, and PDF/UA accessibility. Covers print and PDF output where qa-visual-regression covers the screen.
Progressive web app testing: service worker lifecycle, Workbox caching strategies, offline fallbacks, web push subscriptions, and the install flow. An authoring agent (pwa-test-author) writes one Playwright spec per PWA surface. Distinct from the cross-channel push harness in qa-notifications.
Visual regression testing with Percy, Chromatic, Playwright screenshots and Storybook, plus chart rendering tests for Chart.js, D3 and Vega. Covers responsive breakpoint matrices, baseline conventions, and a binding baseline gate. Agents (visual-diff-classifier, visual-baseline-curator) sort diffs into intentional, incidental or regression and propose an initial baseline set.
Compliance testing for GDPR, CCPA/CPRA, HIPAA, PCI DSS v4.0, SOC 2 and ISO/IEC 27001: control tests, audit-trail tests, and evidence collection. Scores existing tests and evidence against a framework's criteria, packages SOC 2 Type II evidence for auditors, and runs an adversarial readiness review.
Coverage-guided fuzzing with libFuzzer, AFL++, cargo-fuzz, Go native fuzzing, Atheris and Jazzer, plus sanitizer crash triage. Covers fuzzer choice, corpus management, sanitizer integration, and ASan / UBSan / MSan crash classification with bulk triage. A builder agent (fuzz-target-author) scaffolds a fuzz harness from a function signature. Binary and system-level fuzzing, distinct from qa-property-based and qa-api-testing/schemathesis-fuzzing.
Infrastructure-as-code testing: Checkov and Trivy misconfiguration scans, OPA, Conftest and Cedar policy tests, Helm chart tests, Terraform plan review. Trivy config is the tfsec successor, with the legacy tfsec workflow in references. A review agent (terraform-plan-reviewer) flags destructive and security-degrading plan changes. Cross-scanner IaC triage is handled by security-finding-triager in qa-security-scanning.
Tenant isolation testing for B2B SaaS: cross-tenant leak tests with a CI gate, row-level security, and tenant onboarding and offboarding tests. Includes silo / pool / bridge isolation models and a Postgres-first RLS reference. A review agent (tenant-leak-critic) traces tenant-id propagation through a diff to find leak risks.
Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
Test data privacy: detect and mask PII with Presidio, verify k-anonymity on masked datasets, and generate synthetic patient records with Synthea. The masking pipeline runs detect, mask and verify, with PII-category, masking-technique and Faker-substitution catalogs in references.
Bug reproduction and triage: well-formed bug reports, minimal failing tests built from issue reports, and CI failure classification before a fix starts. Also classifies production escapes by root gap. Agents (bug-report-from-recording, bug-repro-builder, defect-pipeline-runner) turn Playwright traces and HAR files into bug reports, build the repro test, and run the weekly defect review that clusters the backlog and narrates trends.
Defect management: severity vs priority classification, bug tracker workflows on Jira, Linear, GitHub Issues and Azure DevOps, and fix confirmation. Agents (ci-defect-filer, defect-fix-verifier) turn CI failures into deduplicated tracker bugs and re-run a defect's reproduction once a fix is claimed. Distinct from qa-bug-repro, which covers reproduction, report authoring, and the weekly defect review.
Flaky test triage: find the condition a flake depends on, quarantine it with an expiry date, fix known flake patterns, and track flake rates. Agents (e2e-flake-bisector, regression-bisector) rerun a test under varied conditions with a shared-state isolation stage, and run git bisect to find the commit that introduced a regression, with a perf-measurement mode.
Load and performance testing with k6 and JMeter, Lighthouse CI for Web Vitals, SLO-driven load plans, and performance budget gates. Covers tool choice and load profiles (with Gatling and Locust references), per-interaction INP budgets, flame-graph analysis, and database query-plan analysis.
Chaos engineering and resilience drills: chaos experiment design, Chaos Mesh and Toxiproxy fault injection, disaster recovery drills, error-budget gates. Covers steady-state hypotheses with LitmusChaos and Gremlin routing, a drill run protocol with pre-flight and abort gates, combined HTTP and TCP fault injection, backup restore and RTO measurement, and burn-rate alerting with MTTR / MTBF / MTTD / MTTA incident metrics.
Shift-left QA: testability reviews of specs before implementation, non-functional requirements turned into testable thresholds, and STRIDE threat modeling. Acceptance-criteria extraction and Gherkin coverage mapping live in qa-bdd; data-contract extraction lives in qa-data-quality.
Shift-right production QA: synthetic monitors, canary validation against baseline metrics, and release runbooks. Follows the ISTQB definition of shift right (testing a system continuously in production) and covers RUM coverage gaps and multi-team cutovers. An agent (observability-to-test) turns production alerts and errors into regression tests.
Background job and queue testing for Sidekiq, Celery, BullMQ, SQS, RabbitMQ and Kafka consumers, plus cron schedules and idempotency guarantees. A read-only critic agent (async-job-health-critic) flags missing retry limits, absent dead-letter routing, and other at-least-once reliability defects in queue and worker code.
Cache testing across browser, CDN, proxy, application and data-store layers: Redis, CDN purges, Varnish VTC tests, and cache-key collision audits. Covers RFC 9111 HTTP caching, Cloudflare / Fastly / CloudFront purge APIs, browser Cache-Control tests, and cache-coherence patterns with stampede and stale-while-revalidate references. A detector agent (cache-key-collision-detector) finds keys missing a tenant, user or locale discriminator.
Concurrency testing: deterministic race-condition tests, deadlock detection, async ordering checks, and database MVCC isolation-level tests. Includes ThreadSanitizer and the Go race detector with goleak, plus a critic agent (concurrency-critic) that flags unguarded shared state and lock-ordering risks. Code-level races, distinct from qa-resilience (infrastructure fault injection).
Database migration testing for Flyway, Liquibase and Atlas: classify every schema change by risk and review blast radius and locking before it ships. Sorts DDL and DML into an eight-category operation taxonomy. A review agent (migration-blast-radius-reviewer) covers blast radius plus DDL performance: CONCURRENTLY index builds, ACCESS EXCLUSIVE rewrites, post-migration ANALYZE, and lock-time estimates.
Distributed tracing tests with OpenTelemetry: assert span names, attributes, parent links and status, and query Jaeger, Zipkin or Tempo in CI. Validates OpenTelemetry Collector pipelines and writes per-feature trace specs. A review agent (trace-coverage-reviewer) finds untraced critical paths and spans missing semantic-convention attributes.
Saga, CQRS and event sourcing tests: compensating actions, the transactional outbox, replay determinism, and projection consistency windows. A critic agent (saga-critic) flags missing compensating transactions and other distributed-transaction defects.
Serverless testing for AWS Lambda, Azure Functions and Cloudflare Workers: local emulators, cold-start and timeout budgets, and integration test suites. Builds integration tests from SAM, Serverless Framework, Wrangler, Vercel or Netlify definitions and covers .NET Lambda test tools. A critic agent (serverless-cold-start-critic) flags cold-start anti-patterns.
Time and timezone testing: fake clocks across runtimes, DST transitions, leap seconds, and timezone test matrices built from a codebase's date handling. Fake clocks cover freezegun, Jest and Sinon fake timers, timecop, java.time.Clock, .NET TimeProvider and libfaketime. A critic agent (time-handling-critic) flags naive now() calls and DST-unsafe arithmetic.
Authentication flow testing: OAuth 2.0 with PKCE, multi-factor authentication, and session management, plus Keycloak, Auth0 and Okta integration tests. Anchored on RFC 7636, RFC 9700 and OWASP ASVS V3. A critic agent (token-storage-security-critic) flags tokens in localStorage, auth cookies missing httpOnly / Secure / SameSite, and tokens leaking into logs or URLs.
Feature-flag and experimentation testing: LaunchDarkly and OpenFeature SDK tests, flag test matrices, A/B test validity, and experiment result analysis. Covers Unleash, Flagsmith and GrowthBook through OpenFeature, and hermetic harnesses for Statsig, Optimizely, Split.io, Amplitude Experiment and VWO. Agents (flag-coverage-gap-detector, stale-flag-detector, sample-ratio-mismatch-detector) find untested flag branches, stale flags, and sample ratio mismatch. Distinct from qa-test-environment/feature-flag-test-harness and qa-shift-right/feature-flag-experiment-validator.
GraphQL server testing for Apollo Server, GraphQL Yoga and Hasura: subscriptions, N+1 detection and fixes, and depth and cost limit hardening. Mercurius is covered in the Yoga references, and introspection and persisted-query hardening in the limits skill. Distinct from qa-contract-testing/graphql-schema-regression, which detects schema drift; this plugin tests the server runtime.
gRPC testing: buf lint and breaking-change gates, ghz load tests, grpcurl, mock servers, and streaming RPC test suites. Includes the protobuf versioning catalog, interceptor test patterns, and a status-code catalog. A review agent (grpc-service-reviewer) flags missing status-code assertions and deadline handling. Distinct from qa-contract-testing/protobuf-compat-checking (schema-level breaking detection).
Notification testing across email, SMS, push and webhooks: Mailpit inboxes, Twilio test numbers, FCM, APNs and Web Push, and signed webhook delivery. Covers in-app notifications and legacy MailHog in references, and both webhook senders and receivers. A critic agent (notification-delivery-critic) flags missing idempotency keys, bounce handling, and other delivery defects.
Payment testing for Stripe, Adyen, PayPal and Braintree sandboxes: test cards, webhooks, subscription billing, refunds, chargebacks and 3DS flows. Includes a payment lifecycle state reference and a review agent (payment-flow-critic) that flags missing idempotency keys and other high-incident payment defects. Distinct from qa-compliance/pci-dss-control-test-author (PCI DSS scope and controls).
Real-time protocol testing: WebSocket handshakes and close codes, Server-Sent Events, and MQTT v5 QoS, retained messages and shared subscriptions. Includes SSE load testing with k6 and STOMP / AMQP broker testing in references. A review agent (realtime-protocol-reviewer) flags missing reconnect backoff and unhandled close codes. gRPC streaming lives in qa-grpc and webhooks in qa-notifications.
AI-assisted test generation: LLM-written tests from natural-language specs with confidence scoring, spec coverage gap mapping, and model-based testing. Builds state-machine models and turns them into test suites, and adds adversarial review agents (ai-test-curator, ai-test-shallow-coverage-critic) that catch hallucinated APIs, weak assertions, and happy-path-only coverage.
LLM and prompt evaluation with Promptfoo, DeepEval and Ragas, Giskard vulnerability scans, Langfuse tracing, and golden-dataset regression suites. Audits eval suites for methodology errors. Agents (prompt-eval-reviewer, llm-red-team-planner) review an eval suite and plan adversarial probe campaigns across the OWASP LLM Top 10.
ML model testing: Giskard and Deepchecks validation, Evidently drift monitoring, Fairlearn fairness metrics, and model performance regression gates. Assigns risk tiers with the fairness and explainability evidence each tier requires, and wires Jupyter notebook CI with papermill, nbval, testbook and nbstripout.
Search relevance testing for Elasticsearch, OpenSearch, Solr, vector and hybrid search: judgment lists and NDCG, MRR and recall@k regression checks. Builds judgment lists with rater guidelines, benchmarks vector recall against latency, and measures fusion lift in hybrid pipelines. A review agent (relevance-regression-reviewer) compares before and after metrics per query.
CI/CD test pipelines for GitHub Actions, GitLab CI/CD and Jenkins: matrix builds, sharding, retries, test reports, and artifact handling. Shared conventions cover when to shard and retry, flake quarantine, and per-trigger cadence, with CircleCI patterns in references. A critic agent (ci-pipeline-health-critic) flags test-pipeline anti-patterns such as retries that mask flakiness.
CLI and terminal UI testing: Bats for shell scripts and binaries, Pester for PowerShell, TUI snapshot tests, and conventions for testable CLI output. Snapshot tests capture rendered terminal frames as text or SVG and diff them on every run; the output conventions cover exit codes, stdout vs stderr, and machine-readable modes.
Production code quality checks: SonarQube maintainability gates, Lizard complexity limits, Madge circular dependencies, and Knip dead-code detection. A critic agent (code-quality-critic) merges the tool reports, dedupes overlapping findings, and separates fix-now items from the backlog. Production code only; test-code hygiene lives in qa-test-review.
Manual and exploratory testing: scripted test cases, session-based exploratory charters, decision-table and state-transition test design, and bug bashes. Covers SBTM, Whittaker's tours, Bach and Bolton's heuristics, UAT scripts, and PROOF debriefs. A critic agent (test-script-quality-critic) flags vague preconditions and bundled steps in authored scripts.
Anything else, open an issue on testland/qa or email hello@testland.io.
A set of instructions and references that Claude loads when your request matches its trigger. Each skill covers one tool or technique, such as Playwright screenshot tests or k6 load tests.
A skill teaches Claude a method. An agent is a helper that runs one focused job, like reviewing a database migration, and returns its findings as a table.
In Claude Code, run /plugin marketplace add testland/qa once, then install a role bundle or any single plugin, for example /plugin install qa-starter@testland-qa.
For agents and role bundles, yes. Skills alone also install into Cursor, Copilot, Gemini, Windsurf and 20+ other agents with npx skills add testland/qa.
Every pull request is checked against six dimensions, D1 to D6. Concrete claims need a source cited where they are made, and uncited claims are rejected.
Yes. Add the marketplace, then install any plugin by name, for example /plugin install qa-accessibility@testland-qa.
Yes. testland-qa is open source under the MIT license.